Skip to main content

Security

Use HTTPS for every production request and treat API keys like passwords.

Key handling​

  • Store keys in a server-side secret manager or protected environment variable.
  • Never embed keys in browser or mobile application code.
  • Never commit keys to source control or include them in logs.
  • Use separate keys for separate systems and rotate a key after suspected exposure.

Tenant isolation​

API keys are linked to a merchant. Issued-voucher queries include the authenticated merchant boundary, so another merchant's voucher identifier is not sufficient to access or redeem it.

Sensitive responses​

Voucher responses can contain recipient names and email addresses. Only retain this data where your integration needs it, restrict internal access, and follow applicable privacy requirements.